Read the docs
TI-2026-10726 Aliases CVE-2026-12495GHSA-f8cq-j6x7-pfpx

Stack-Based Buffer Overflow in the Mercusys MB115-4G

Priority LOW 26CWE-121Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Denial-of-service (DoS) vulnerability due to a stack buffer overflow in the http_gdpr_decrypt function of the Mercusys MB115-4G device's web interface. An unauthenticated attacker could exploit this vulnerability by sending a specially crafted request to the /cgi/login endpoint, causing memory corruption and the httpd process to crash, resulting in a denial of service for the web administration service.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00251 16th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MercusysMB115-4G1.7.0 – 1.9.0—No fix listedCNA
  • MB115-4G VendorMercusys Affected 1.7.0 – 1.9.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-12495
  2. 2026-10-03 Alias added: GHSA-f8cq-j6x7-pfpx

References

Patch 1

  • TI-2025-35352 Mercusys MW305R 3.30 and below is has a Transport Layer Security (TLS) certificate private key disclosure. CVSS 3.1MEDIUM 6.8
  • TI-2025-07205 Mercusys MW301R Web Interface password recovery CVSS 4.0MEDIUM 5.1
  • TI-2021-05991 MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ in conjunction with… CVSS 3.1MEDIUM 5.3
  • TI-2022-10208 TP-Link TL-WDR7660 2.0.30, Mercury D196G 20200109_2.0.4, and Fast FAC1900R 20190827_2.0.2… CVSS 3.1HIGH 7.8
  • TI-2022-10207 TP-Link TL-WDR7660 2.0.30, Mercury D196G 20200109_2.0.4, and Fast FAC1900R 20190827_2.0.2… CVSS 3.1HIGH 7.8
  • TI-2021-07878 MERCUSYS Mercury X18G 1.0.5 devices allow Denial of service via a crafted value to the… CVSS 3.1HIGH 7.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences